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Art Unit: 3629 

DETAILED ACTION 

The following is a Non-Final Office action in response to communication received 
August 29, 2008. Claims 1, 4, 7, 9-16 and 18-20 are currently amended. Claims 1-20 are pending 
and addressed below. 



Response to Amendments 
Applicant's amendment to claim 1 1 is sufficient to overcome the 35 U.S.C 1 12, second 
paragraph rejection set forth in the previous office action. Applicant's amendment is sufficient to 
overcome claim objections as well. 



Response to Arguments 

Applicant's arguments filed 8/29/2008 have been fully considered and are persuasive. In 
the remarks, Applicant arguments are moot based on the new grounds of rejections below. 



New Claim Rejections - 35 USC§101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claim 1 recites a method comprising: "comparing", "identifying", "re-ordering" and 
"displaying", however as presented in the claim it is not directed to any form of structure 
and could equate to software components. Based on Supreme Court precedent, a proper 
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process must be tied to another statutory class or transform underlying subject matter to a 
different state or thing. The machine-or-transformation test is a two-branched inquiry; an 
applicant may show that a process claim satisfies § 101 either by showing that his claim 
is tied to a particular machine, or by showing that his claim transforms an article. See 
Benson, 409 U.S. at 70. Certain considerations are applicable to analysis under either 
branch. First, as illustrated by Benson and discussed below, the use of a specific machine 
or transformation of an article must impose meaningful limits on the claim's scope to 
impart patent-eligibility. See Benson, 409 U.S. at 71-72. Second, the involvement of the 
machine or transformation in the claimed process must not merely be insignificant extra- 
solution activity. See Flook, 437 U.S. at 590. The claimed process contains physical steps 
and it does not involve transforming an article into a different state or thing. Therefore, 
Applicants' claim is not drawn to patent-eligible subject matter under § 101, because the 
applicable test to determine whether a claim is drawn to a patent-eligible process under § 
101 is the machine-or-transformation test set forth by the Supreme Court and clarified 
herein, and Applicants' claim here plainly fails that test. See e.g. In re Bilski and Warsaw, 
(Fed. Cir. 2008). 

Claims 2-10 depend fi"om claim 1 and do not cure the deficiencies set forth above. 
Therefore, claims 2-10 are also rejected under 35 USC 101 for being directed to non- 
statutory subject matter. 

Claim 11 recites a system comprising: "user menu", "web browser", "trust engine", 
"transformation module" and "user interface module", none of which are recorded on a 
computer-readable medium. Claim 1 1 has not claimed any physical structure in the 
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system. As per MPEP 2106.01, functional descriptive material is non-statutory when 
claimed as descriptive material per se and not structurally or functionally interrelated to a 
computer-readable medium. Therefore, it is respectfully submitted that claim 1 1 is 
rejected under 35 U.S. C. 101 for being directed to non-statutory subject matter. 
Claim 14 recites a "privacy actuator". It is unclear how a "privacy actuator" constitutes a 
system. Therefore, it is respectfully submitted that claim 14 is rejected under 35 U.S.C. 
101 for being directed to non-statutory subject matter. Examiner interprets the "privacy 
actuator" to mean a matching mechanism containing a combination of software and 
hardware elements. 

Claims 12-13 and 15 depend from claim 1 1 and do not cure the deficiencies set forth 
above. Therefore, claims 12-13 and 15 are also rejected for being directed to non- 
statutory subject matter. 

Claim 16 recites "comparing a set of user concems", "identifying specific portions", "re- 
ordering the privacy statements" and "displaying". However, as presented in the claim the 
limitations are not tied to a physical structure used for performing the series of steps. 
Therefore, it is respectfully submitted that claim 1 1 is rejected under 35 U.S.C. 101 for 
being directed to non-statutory subject matter (MPEP 2106.01). 
Claims 17-20 depend from claim 16 and do not cure the deficiencies set forth above. 
Therefore, claims 17-20 are also rejected under 35 USC 101 for being directed to non- 
statutory subject matter. 
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New Claim Rejections - 35 USC § 112 
The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

Claim 11-15 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

Claim 11 recites in the preamble that the claim is directed towards the statutory category 
of a system. However, the body of claim 1 1 comprises a "menu", "web browser", "trust 
engine" and "modules", and is thus directed towards function descriptive material. 
Therefore, it is not clear how a series of "modules" or functional descriptive material 
constitutes a system. Clarification is required. For examination purposes, the Examiner is 
interpreting the system to contain a combination of software and hardware elements. 
Claim 14 recites "privacy actuator". It is unclear and indefinite as to what a "privacy 
actuator" means. There is no support or definition in the disclosure. Claim 14 points to 
the steps the "privacy actuator" performs, but does not define it. Examiner interprets the 
"privacy actuator" to mean a matching mechanism containing a combination of software 
and hardware elements. 

Claims 12-13 and 15 depend from claim 1 1 and contain the same deficiencies. 
Therefore, claims 12-15 are also rejected under 35 U.S.C. 1 12, second paragraph, for 
failing to particularly point out and distinctly claim the subject matter which the applicant 
regards as his/her invention. Clarification is required. For examination purposes, the 
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Examiner is interpreting the system to contain a combination of software and hardware 
elements. 

New Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-6, and 8-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Barzilai et al. (US 2002/0104015 Al) (hereinafter Barzilai) in view of Ahlstrom et al. (US 
6,327,618 Bl) (hereinafter Ahlstrom). 
As per claim 1, Barzilai discloses a method, comprising: 

comparing one or more user concems with a Web site privacy policy ([0003-4, Platform 
for Privacy Preference Project (P3P) browsers automatically read a web site's privacy 
policies and compare it to the consumer's (users) privacy preferences (concems)]; see 
also, [001 1-14, the enterprise privacy manager (EPM) ensures that the users receive 
notice of the policy of the web site they are currently visiting and that the user consent to 
the policy before submitting user's private information]; see also, [0024, 0075, prompting 
the user to provide input to indicate whether the user accepts or rejects the change]; see 
also. Fig. 6, item 88); 



Barzilai does not expressly disclose: 
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identifying specific portions of the Web site privacy policy that conflict with the user 
concerns; and re-ordering the Web site privacy policy such that the identified specific 
portions of the Web site privacy pohcy that conflict with the user concerns appear before 
the portions of the Web site privacy policy that do not conflict with the user concerns; 
and displaying the re-ordered Web site privacy policy. 

However, Ahlstrom teaches identifying a policy conflict when a first condition of the first 
policy and a second condition of the second policy conflict (col. 4, lines 9-18). In 
addition, Ahlstrom teaches when a conflict is found the policy verifler displays the 
conflicting policies to a user and promotes the user to correct one or both policies so that 
they do not conflict; and displaying the conflicting policies for prompting the user to 
choose which of the policies is to take precedence over the other policies. Furthermore, 
Ahlstrom teaches once the conflict resolution is completed the system executes the 
corrected or re-ordered policies (col. 10, lines 21-67). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the web site privacy policy analysis of Barzilai to include a method 
for recognizing and processing conflicts in pohcies that govem a policy based system as 
taught by Ahlstrom in order to create a time efficient privacy management solution for 
managing variations in privacy poUcy that may be implemented in different parts of a 
single enterprise or changes in privacy policy that may occur over time. 
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As per claims 2 and 3, Barzilai and Ahlstrom disclose claim 1 as rejected above, wherein 

Barzilai further discloses: 

collecting user concerns from a user ([0002, information collected from users by network 
servers]; see also, [0059, 0070, collecting information from users]), 
collecting the user concems from a user via a concems settings user interface ([0063, 
0069-73 EPM comprises a number of interfaces; a user request handler which collects 
data to be passed to personal information engine]). 

As per claim 4, Barzilai and Ahlstrom disclose claim 1 as rejected above, wherein Barzilai 
further discloses: 

the Web site privacy policy includes one or more policy statements ([0097, web site 
privacy policy are presented to the user in a variety of ways such as a list of privacy rules 
that are pertinent to the requested personal information]); md 

the comparing fiirther comprises comparing each privacy policy statement with each user 
concem ([0113, the privacy policy and the list of requested data are passed to matcher in 
personal information engine, which compares the privacy policy to the specific privacy 
rules]). 

As per claims 5 and 6, Barzilai and Ahlstrom disclose claim 1 as rejected above, wherein 

Barzilai further discloses: 

wherein the privacy policy further comprises a policy file that conforms to P3P (Platform 
for Privacy Preferences Project) standards ([0004, P3P provides a standardized set of 
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multiple choice questions, covering major aspects of a Web site's privacy policies, in 
order to give a "snapshot" of how a site handles personal information about its users]). 

the privacy policy is contained in an XML (extensible Markup Language) file. 
([0004, P3P enabled web sites make this information available in a standard, machine- 
readable format using Extensible Markup Language (XML) and the Hypertext Transfer 
Protocol (HTTP)]). 

As per claim 8, Barzilai and Ahlstrom disclose claim 1 as rejected above, but Barzilai does not 
expressly disclose notifying the user that a conflict exists between the user concerns and the Web 
site privacy policy file. 

However, Ahlstrom teaches wherein administrators are informed when policies conflict 

and are given tools to resolve conflict (col. 9, lines 6-37). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Barzilai to include a form of notification when policies conflict as 
taught by Ahlstrom in order to create a time efficient process for resolving policy 
conflicts. 

As per claim 9, Barzilai and Ahlstrom disclose claim 1 as rejected above, wherein Barzilai 
further discloses wherein the displaying is performed in response to a user request to display the 
re-ordered Web site privacy policy ([0025, a request by the user to access the given resource 
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responsive to the request.... conveying the privacy policy in a standard form for presentation by a 
web browser]; see also, [0063, privacy policies are displayed on user's browser]; see also, [0096, 
display new privacy policy on the user's computer upon request]). 

As per claim 10, Barzilai and Ahlstrom disclose claim 1 as rejected above, wherein Barzilai 

further discloses where claim 1 further comprising receiving a user request to initiate a policy 
analysis ([0050, query the application to determine compliance with privacy pohcies subject to 
which the requested information was received]; see also, [0024, prompting the user to provide 
input]). 

As per claim 11, Barzilai discloses a system, comprising: 

a user concems menu to allow a user to enter user concems that are privacy concem 
preferences applicable to browsing Web sites ([0003, 0024, web sites prompt users to 
input various items]; see also, [0061-62, graphical user interface enables the 
administrator to create, review, and edit policies]); 

a Web browser to allow the user to access one or more network Web sites ([0025, web 
browser]); 

a trust engine toj_compare the user concems with a privacy policy file included in a Web 
site ([0004, P3P enable browsers can read the policy automatically and compare it to the 
consumer's own set of privacy preferences]; see also, [01 13, privacy policy and the list of 
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requested data are passed to matcher 52 in a personal engine which compares the privacy 
policy to the specific privacy rules goveming each item of requested data])^ and 



Barzilai does not expressly disclose: 

identify specific portions of the privacv policv file that conflict with the user concems ; 
a transformation module to transform the privacy policy file into a user-centric policy 
display that emphasizes the specific portions of the privacy policy file that conflict with 
the user concems; a user interface module to display a user interface that includes at least 
the specific portions of the privacy policy file that conflict with the user concems. 



However, Ahlstrom teaches identifying a policy conflict when a first condition of the first 
policy and a second condition of the second policy conflict (col. 4, lines 9-18). In 
addition, Ahlstrom teaches when a conflict is found the policy verifier displays the 
conflicting policies to a user and promotes the user to correct one or both policies so that 
they do not conflict; and displaying the conflicting policies for prompting the user to 
choose which of the policies is to take precedence over the other policies. Furthermore, 
Ahlstrom teaches once the conflict resolution is completed the system executes the 
corrected or re-ordered policies (col. 10, lines 21-67; see also, col. 12, lines 15-63 
computer system is coupled via a bus to display a cathode ray tube for displaying 
information to a computer user). 
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Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the web site privacy policy analysis of Barzilai to include a method 
for recognizing and processing conflicts in pohcies that govem a policy based system as 
taught by Ahlstrom in order to create a time efficient privacy management solution for 
managing variations in privacy poUcy that may be implemented in different parts of a 
single enterprise or changes in privacy policy that may occur over time. 

As per claim 12, Barzilai and Ahlstrom disclose claim 1 1 as rejected above, wherein Barzilai 
further discloses wherein the trust engine further compares each user concem with each of 
multiple statements making up the privacy policy file ([0113, privacy policy and the list of 
requested data are passed to matcher 52 in a personal engine which compares the privacy policy 
to the specific privacy rules governing each item of requested data]). 

As per claim 13, Barzilai and Ahlstrom disclose claim 1 1 as rejected above, wherein Barzilai 
discloses a collection of web pages accessible through a web site of the enterprise and wherein 
providing the privacy policy includes conveying the policy in a standard form for presentation by 
a Web browser ([0025]), but does not expressly disclose wherein the Web browser further 
provides a conflict notification when there is a conflict between a user concem and the privacy 
policy file. 

However, Ahlstrom teaches wherein administrators are informed when policies conflict 
and are given tools to resolve conflict (col. 9, lines 6-37). In addition, Ahlstrom teaches a 
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policy verifier the checks each pohcy for conflicts, notifies a user or other system, and 
resolves the conflicts (col. 12, lines 6-14). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Barzilai to include a form of notification when policies conflict as 

taught by Ahlstrom in order to create a time efficient process for resolving policy 
conflicts. 

As per claim 14, Barzilai and Ahlstrom disclose claim 1 1 as rejected above, wherein Barzilai 
further discloses wherein the Web browser further provides a privacy actuator that, when 
activated, initiates the compare, the identitv. the transform and tiie display ([0113, matcher 52 in 
the personal information engine]). 

As per claim 15, Barzilai and Ahlstrom disclose claim 1 1 as rejected above, wherein Barzilai 
does not expressly disclose: wherein the user interface module displays the portions of the 
privacy policy file that conflict with the user concems more prominently than the portions of the 
privacy policy file that do not conflict with the user concems 

However, Ahlstrom teaches displaying information that describes the conflict; and 
receiving modification information that modifies the first policy or the second policy so 
as to eliminate the conflict. In addition, Ahlstrom teaches displaying information that 
describes the conflict and receiving precedence information that identifies whether the 
first policy of the second policy shall take precedence (col. 4, lines 9-23). Furthermore, 
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Ahlstrom teaches wherein resolving conflict between two policies and administrator may 
change one or both of them; and can supply the system with information on the relative 
priorities of the policies (col. 9, lines 29-37; see also, col. 10, lines 29-37, a text based or 
graphical policy editor). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Barzilai to include a conflict resolution text based or graphical policy 
editor as taught by Ahlstrom in order to create a process that reports to the user or to 
system the consequences of a particular poUcy conflict resolution and executing the 
corrected or re-ordered policies in a time efficient manner. 

As per claim 16, Barzilai discloses one or more computer-readable media including computer- 
executable instructions that, when executed on a computer, perform a method of evaluating 
computer-based privacv policies comprising : 

comparing a set of user concems with a set of Web site privacy policy statements to 
determine if a privacy policy statement conflicts with a user concem ([0004, 0048-50 P3P 
enabled web sites make this information available in a standard, machine-readable format 
using extensible markup language (XM) and the hypertext transfer protocol (HTTP) and 
P3P enabled browsers read the policy snapshot automatically and compare it to the 
consumers own set or privacy preferences]); 

Barzilai does not expressly disclose: 



Application/Control Number: 10/693,333 Page 15 

Art Unit: 3629 

identifying specific portions of the privacy policy statement that conflict with the user 
concern ; re-ordering the privacy policy statements so that the specific portions of the 
privacy policy statement that conflict with the user concem appear before the portions of 
the privacy policy statement that do not conflict with the user concem ; and displaying a 
user interface that presents the re-ordered privacy policy statements. 

However, Ahlstrom teaches identifying a policy conflict when a first condition of the first 
policy and a second condition of the second policy conflict (col. 4, lines 9-18). In 
addition, Ahlstrom teaches when a conflict is found the policy verifler displays the 
conflicting policies to a user and promotes the user to correct one or both policies so that 
they do not conflict; and displaying the conflicting policies for prompting the user to 
choose which of the policies is to take precedence over the other policies. Ahlstrom 
further teaches once the conflict resolution is completed the system executes the 
corrected or re-ordered policies (col. 10, lines 21-67). Furthermore, Ahlstrom teaches 
wherein conflict resolution is accomplished by the system keeping a partial order of all 
policies, or of all conflicting policies (col. 9, lines 34-36). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the web site privacy policy analysis of Barzilai to include a method 
for recognizing and processing conflicts in poUcies that govem a policy based system as 
taught by Ahlstrom in order to create a time efficient privacy management solution for 
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managing variations in privacy policy that may be implemented in different parts of a 
single enterprise or changes in privacy policy that may occur over time. 

As per claim 17, Barzilai and Ahlstrom disclose claim 16 as rejected above, wherein Barzilai 
further discloses collecting the set of user concems from a user ([0002, information collected 

from users by network servers]; see also, [0059, 0070, collecting information from users]). 

As per claim 18, Barzilai and Ahlstrom disclose claim 16, wherein Barzilai further discloses 
receiving a prompt from a user before executing the comparin g, identifying, re-ordering, and the 
displaying ([0012, EPM prompts the user for consent to change before allowing the interaction to 
continue]). 

As per claims 19 and 20, Barzilai and Ahlstrom disclose claim 16 as rejected above, but 
Barzilai does not expressly disclose providing a conflict notification to a user to inform the user 
that specific portions of the privacv policv statement that conflict with the user concem have 
been identified ; and only performing the displaying upon detection of a user response to the 
conflict notiflcation. 

However, Ahlstrom teaches wherein administrators are informed when policies conflict 
and are given tools to resolve conflict (col. 9, lines 6-37). In addition, Ahlstrom teaches a 
policy verifier the checks each poUcy for conflicts, notifies a user or other system, and 
resolves the conflicts (col. 12, lines 6-14). 



Application/Control Number: 10/693,333 Page 17 

Art Unit: 3629 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Barzilai to include a form of notification when policies conflict as 
taught by Ahlstrom in order to create a time efficient process for resolving policy 
conflicts. 

Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over Barzilai in 
view of (www,w3schools,com) (hereinafter WSSchools) (© Feb. 2003). 
As per claim 7, Barzilai and Ahlstrom disclose claim 1 as rejected above, but do not expressly 
disclose wherein displaving the re-ordered Web site privacv pohcv includes displaving the re- 
ordered Web site privacy policy in an XSL (extensible Stylesheet Language) transformation. 

However, W3 Schools teaches how XML documents are displayed and transformed into 

XSL language (Pgs.1-1 1, XSL transformation). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the web site privacy policy analysis of Barzilai and the policy based 
method and system of Ahlstrom to include an XSL transformation process for displaying 
the re-ordered web site privacy policy as taught by W3 Schools in order to efficiently and 
effectively display the privacy policy in XSL format. 

Please note : 

Applicant(s) are reminded that optional or conditional elements do not narrow the claims 
because they can always be omitted. See e.g. MPEP §2106 II C: "Language that suggest or 
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makes optional but does not require steps to be performed or does not limit a claim to a particular 
structure does not limit the scope of a claim or claim limitation"; and In re Johnston, 435 F.3d 
1381, 77 USPQ2d 1788, 1790 (Fed. Cir. 2006) "As a matter of linguistic precision, optional 
elements do not narrow the claim because they can always be omitted." In re Johnston, 435 F.3d 
1381, 77 USPQ2d 1788, 1790 (Fed. Cir. 2006)(where the Federal Circuit affirmed the Board's 
claim construction of ''further including that said wall may be smooth, corrugated, or profiled 
with increased dimensional proportions as pipe size is increased" since "this additional content 
did not narrow the scope of the claim because these limitations are stated in the permissive form 
'may.'"). 



Conclusion 

Examiner has pointed out particular references contained in the prior arts of record in 
the body of this action for the convenience of the applicant. Although the specified citations 
are representative of the teachings in the art and are applied to the specific limitations within 
the individual claim, other passages and figures may apply as well. It is respectfiiUy requested 
from the applicant, in preparing the response, to consider fully the entire references as 
potentially teaching all or part of the claimed invention, as well as the context of the passage as 
taught by the prior arts or disclosed by the examiner. 

Any inquiry conceming this communication or earlier communications from the 
examiner should be directed to BOB CHUMPITAZ whose telephone number is (571) 270-5494. 
The examiner can normally be reached on M-TR: 7:30AM - 6:00 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, JOHN WEISS can be reached on (571) 272-6812. The fax phone number for the 
organization where this application or proceeding is assigned is 571-270-6494. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
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